Description:
The Senior Cybersecurity Analyst is responsible for advanced incident response, threat hunting, DLP monitoring and maintaining the security tools that are used to secure our environment. The Cybersecurity group at KLA is involved in every aspect of the global business. The KLA Cybersecurity group defends against cyber-attacks and provides cybersecurity tools, incident response services and assessment capabilities to safeguard the environments that support the essential operations of KLA. We are passionate about identifying adversarial activities and anticipating a wide variety of threats to strengthen our defenses and the overall protection of KLA Intellectual Property.
Responsibilities:
- Actively preform detection, monitoring, analysis, and resolution of security incidents
- Plan and execute regular incident response and postmortem exercises, with a focus on crafting measurable benchmarks to show progress (or deficiencies requiring additional attention)
- Provide guidance, support and training for junior level security analysts
- Provide SOC subject matter expertise for broader IT and Security efforts
- Facilitate the development and tuning of AV, EDR, SIEM, and DLP rules to ensure high fidelity alerting
- Compose security alert notifications
- Must be able to prioritize their own work to provide a positive customer experience
- Maintain awareness of current threat landscape and regulatory requirements
- Participate in rotational on-call schedule to respond to security events 24x7
- Generate reports from different data sources and present to management when requested
Preferred Qualifications:
- Relevant security related certification(s) a plus: GCIA, GSEC, GCIH, GCED, GCFA, GREM
Minimum Qualifications
- Bachelor’s degree in an Information Security or related technical field
- Five (5) years of experience working in a SOC environment in an Incident Responder role
- Strong working knowledge of EDR, SIEM, AV, proxies, WAF, IDS, OS's and forensics tools
- Five (5) years of related experience in cybersecurity or related technologies such as: firewalls/AV/EDR/IPS/IDS/SIEM systems
- Some domestic and/or international travel (up to 25%) may be required.
- This is a Hybrid Role and will be based at our Midwest HQ in Ann Arbor, MI